Bugzilla – Bug 460
sudo ignores timelimit and hangs if slapd hangs
Last modified: 2011-01-12 06:25:32 MST
sudo ignores timelimit option and waits forever if configured using ldap and ldap server hangs. timelimit from ldap.conf and ldap.conf.sudo is ignored as can be seen by strace output, all timeouts had beens set to 3s in ldap.conf and ldap.conf.sudo: ldapsearch (correct behaviour, ending after 3s timeout): gettimeofday({1294662432, 883282}, NULL) = 0 poll([{fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 3000) = 0 (Timeout) write(2, "ldap_result: Timed out (-5)\n", 28ldap_result: Timed out (-5) ) = 28 exit_group(-2) = ? sudo (waiting forever): write(5, "0\f\2\1\1`\7\2\1\3\4\0\200\0", 14) = 14 poll([{fd=5, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, -1 This will cause all jobs using sudo to hang.
Do you get the same results with bind_timelimit=3 set in ldap.conf.sudo? This corresponds to OpenLDAP's NETWORK_TIMEOUT option which I believe is the one you want. If you set sudo_debug=1 in ldap.conf.sudo it will display the LDAP configuration values that sudo has parsed from the config file.
The configuration value bind_timelimit is parsed and works correct if slapd is down, but the configuration values timeout and timelimit are not used. TIMEOUT <integer> Specifies a timeout (in seconds) after which calls to synchronous LDAP APIs will abort if no response is received. Also used for any ldap_result(3) calls where a NULL timeout parameter is supplied. So if slapd accepts connection requests but does not supply an answer because it hangs, then sudo will wait forever. We can reproduce that using an Openldap server under Solaris using 'pstop' on the slapd server process. Sudo will hang until slapd is continued using 'prun'. sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_set_option: timelimit -> 3 sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 6) --> now sudo will wait until it gets a response from slapd or slapd is restarted.
Created attachment 298 [details] Implement suport for the ldap.conf TIMEOUT option Sudo 1.7.4 doesn't support OpenLDAP's TIMEOUT option which is probably the root of the problem. Mozilla-derived LDAP SDKs don't support this option but we can emulate it by passing the timeout to ldap_search_ext_s(). I've added support for this which will be in sudo 1.7.5 and have attached a patch to back-port support for sudo 1.7.4. Please give it a try.
Problem solved with patch for Linux. Will now check with other OSs in our environment. Thanks for immediate response. Great work.